feat(falcon-imageanalyzer): Add image exclusions

gpontejos-cs · gpontejos-cs · commit aba36f982823 · 2026-01-26T10:19:35.000-06:00
diff --git a/api/falcon/v1alpha1/falconimageanalyzer_types.go b/api/falcon/v1alpha1/falconimageanalyzer_types.go
@@ -180,6 +180,10 @@ type Exclusions struct {
 	// Configure a list of namespaces for Image Analyzer to ignore.
 	// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Ignore Namespace List",order=2
 	Namespaces []string `json:"namespaces,omitempty"`
+
+	// Configure a list of image names for Image Analyzer to ignore.
+	// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Ignore Images List",order=3
+	ImageNames []string `json:"imageNames,omitempty"`
 }
 
 type RegistryConfig struct {
diff --git a/api/falcon/v1alpha1/zz_generated.deepcopy.go b/api/falcon/v1alpha1/zz_generated.deepcopy.go
@@ -258,6 +258,11 @@ func (in *Exclusions) DeepCopyInto(out *Exclusions) {
 		*out = make([]string, len(*in))
 		copy(*out, *in)
 	}
+	if in.ImageNames != nil {
+		in, out := &in.ImageNames, &out.ImageNames
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Exclusions.
diff --git a/config/crd/bases/falcon.crowdstrike.com_falcondeployments.yaml b/config/crd/bases/falcon.crowdstrike.com_falcondeployments.yaml
@@ -3364,6 +3364,12 @@ spec:
                       exclusions:
                         description: Exclusions for the Falcon Image Analyzer.
                         properties:
+                          imageNames:
+                            description: Configure a list of image names for Image
+                              Analyzer to ignore.
+                            items:
+                              type: string
+                            type: array
                           namespaces:
                             description: Configure a list of namespaces for Image
                               Analyzer to ignore.
diff --git a/config/crd/bases/falcon.crowdstrike.com_falconimageanalyzers.yaml b/config/crd/bases/falcon.crowdstrike.com_falconimageanalyzers.yaml
@@ -125,6 +125,12 @@ spec:
                   exclusions:
                     description: Exclusions for the Falcon Image Analyzer.
                     properties:
+                      imageNames:
+                        description: Configure a list of image names for Image Analyzer
+                          to ignore.
+                        items:
+                          type: string
+                        type: array
                       namespaces:
                         description: Configure a list of namespaces for Image Analyzer
                           to ignore.
diff --git a/deploy/falcon-operator.yaml b/deploy/falcon-operator.yaml
@@ -6766,6 +6766,12 @@ spec:
                       exclusions:
                         description: Exclusions for the Falcon Image Analyzer.
                         properties:
+                          imageNames:
+                            description: Configure a list of image names for Image
+                              Analyzer to ignore.
+                            items:
+                              type: string
+                            type: array
                           namespaces:
                             description: Configure a list of namespaces for Image
                               Analyzer to ignore.
@@ -8143,6 +8149,12 @@ spec:
                   exclusions:
                     description: Exclusions for the Falcon Image Analyzer.
                     properties:
+                      imageNames:
+                        description: Configure a list of image names for Image Analyzer
+                          to ignore.
+                        items:
+                          type: string
+                        type: array
                       namespaces:
                         description: Configure a list of namespaces for Image Analyzer
                           to ignore.
diff --git a/docs/deployment/openshift/resources/imageanalyzer/README.md b/docs/deployment/openshift/resources/imageanalyzer/README.md
@@ -59,6 +59,7 @@ spec:
 | imageAnalyzerConfig.priorityClass.name        | (optional) Set to avoid pod evictions due to resource limits.                                                                                                                                           |
 | imageAnalyzerConfig.exclusions.registries     | (optional) Set the value as a list of registries to be excluded. All images in that registry(s) will be excluded                                                                                                    |
 | imageAnalyzerConfig.exclusions.namespaces     | (optional) Set the value as a list of namespaces to be excluded. All pods in that namespace(s) will be excluded                                                                                                     |
+| imageAnalyzerConfig.exclusions.imageNames     | (optional) Set the value as a list of fully qualified image names to be excluded.                                                                                                    |
 | imageAnalyzerConfig.imagePullPolicy           | (optional) Configure the image pull policy of the Falcon Image Analyzer                                                                                                                                           |
 | imageAnalyzerConfig.imagePullSecrets          | (optional) Configure the image pull secrets of the Falcon Image Analyzer                                                                                                                                          |
 | imageAnalyzerConfig.registryConfig.credentials | (optional) Use this to provide registry secrets in the form of a list of maps. e.g.<pre>- namespace: ns1<br>&nbsp;&nbsp;secretName: mysecretname</pre>To scan OpenShift control plane components, specify the cluster's pull secret: <pre>- namespace: openshift-config<br>&nbsp;&nbsp;secretName: pull-secret</pre>  |
diff --git a/docs/resources/imageanalyzer/README.md b/docs/resources/imageanalyzer/README.md
@@ -59,6 +59,7 @@ spec:
 | imageAnalyzerConfig.priorityClass.name        | (optional) Set to avoid pod evictions due to resource limits.                                                                                                                                           |
 | imageAnalyzerConfig.exclusions.registries     | (optional) Set the value as a list of registries to be excluded. All images in that registry(s) will be excluded                                                                                                    |
 | imageAnalyzerConfig.exclusions.namespaces     | (optional) Set the value as a list of namespaces to be excluded. All pods in that namespace(s) will be excluded                                                                                                     |
+| imageAnalyzerConfig.exclusions.imageNames     | (optional) Set the value as a list of fully qualified image names to be excluded.                                                                                                    |
 | imageAnalyzerConfig.imagePullPolicy           | (optional) Configure the image pull policy of the Falcon Image Analyzer                                                                                                                                           |
 | imageAnalyzerConfig.imagePullSecrets          | (optional) Configure the image pull secrets of the Falcon Image Analyzer                                                                                                                                          |
 | imageAnalyzerConfig.registryConfig.credentials | (optional) Use this to provide registry secrets in the form of a list of maps. e.g.<pre>- namespace: ns1<br>&nbsp;&nbsp;secretName: mysecretname</pre>To scan OpenShift control plane components, specify the cluster's pull secret: <pre>- namespace: openshift-config<br>&nbsp;&nbsp;secretName: pull-secret</pre>  |
diff --git a/docs/src/resources/imageanalyzer.md.tmpl b/docs/src/resources/imageanalyzer.md.tmpl
@@ -59,6 +59,7 @@ spec:
 | imageAnalyzerConfig.priorityClass.name        | (optional) Set to avoid pod evictions due to resource limits.                                                                                                                                           |
 | imageAnalyzerConfig.exclusions.registries     | (optional) Set the value as a list of registries to be excluded. All images in that registry(s) will be excluded                                                                                                    |
 | imageAnalyzerConfig.exclusions.namespaces     | (optional) Set the value as a list of namespaces to be excluded. All pods in that namespace(s) will be excluded                                                                                                     |
+| imageAnalyzerConfig.exclusions.imageNames     | (optional) Set the value as a list of fully qualified image names to be excluded.                                                                                                    |
 | imageAnalyzerConfig.imagePullPolicy           | (optional) Configure the image pull policy of the Falcon Image Analyzer                                                                                                                                           |
 | imageAnalyzerConfig.imagePullSecrets          | (optional) Configure the image pull secrets of the Falcon Image Analyzer                                                                                                                                          |
 | imageAnalyzerConfig.registryConfig.credentials | (optional) Use this to provide registry secrets in the form of a list of maps. e.g.<pre>- namespace: ns1<br>&nbsp;&nbsp;secretName: mysecretname</pre>To scan OpenShift control plane components, specify the cluster's pull secret: <pre>- namespace: openshift-config<br>&nbsp;&nbsp;secretName: pull-secret</pre>  |
diff --git a/internal/controller/falcon_image_analyzer/configmap.go b/internal/controller/falcon_image_analyzer/configmap.go
@@ -106,6 +106,10 @@ func (r *FalconImageAnalyzerReconciler) newConfigMap(ctx context.Context, name s
 		data["AGENT_REGISTRY_EXCLUSIONS"] = strings.Join(falconImageAnalyzer.Spec.ImageAnalyzerConfig.Exclusions.Registries, ",")
 	}
 
+	if len(falconImageAnalyzer.Spec.ImageAnalyzerConfig.Exclusions.ImageNames) > 0 {
+		data["AGENT_IMAGE_EXCLUSIONS"] = strings.Join(falconImageAnalyzer.Spec.ImageAnalyzerConfig.Exclusions.ImageNames, ",")
+	}
+
 	data["AGENT_DEBUG"] = strconv.FormatBool(falconImageAnalyzer.Spec.ImageAnalyzerConfig.EnableDebug)
 
 	// Registry auto-discovery configuration
diff --git a/internal/controller/falcon_image_analyzer/image_push.go b/internal/controller/falcon_image_analyzer/image_push.go
@@ -49,7 +49,7 @@ func (r *FalconImageAnalyzerReconciler) PushImage(ctx context.Context, log logr.
 	image := image.NewImageRefresher(ctx, log, falconApiConfig, pushAuth, falconImageAnalyzer.Spec.Registry.TLS.InsecureSkipVerify)
 	version := falconImageAnalyzer.Spec.Version
 
-	tag, err := image.Refresh(registryUri, falcon.ImageSensor, version)
+	tag, err := image.Refresh(registryUri, falcon.RegionedImageSensor, version)
 	if err != nil {
 		return fmt.Errorf("Cannot push Falcon Image Analyzer Image: %v", err)
 	}
@@ -139,7 +139,7 @@ func (r *FalconImageAnalyzerReconciler) registryUri(ctx context.Context, falconI
 			return "", err
 		}
 
-		return falcon.FalconContainerSensorImageURI(cloud, falcon.ImageSensor), nil
+		return falcon.FalconContainerSensorImageURI(cloud, falcon.RegionedImageSensor), nil
 	default:
 		return "", fmt.Errorf("Unrecognized registry type: %s", falconImageAnalyzer.Spec.Registry.Type)
 	}
@@ -209,7 +209,7 @@ func (r *FalconImageAnalyzerReconciler) setImageTag(ctx context.Context, falconI
 		return "", err
 	}
 
-	tag, err := registry.LastContainerTag(ctx, falcon.ImageSensor, falconImageAnalyzer.Spec.Version)
+	tag, err := registry.LastContainerTag(ctx, falcon.RegionedImageSensor, falconImageAnalyzer.Spec.Version)
 	if err == nil {
 		falconImageAnalyzer.Status.Sensor = common.ImageVersion(tag)
 	}
diff --git a/pkg/registry/falcon_registry/container.go b/pkg/registry/falcon_registry/container.go
@@ -24,7 +24,7 @@ func (reg *FalconRegistry) LastContainerTag(ctx context.Context, sensorType falc
 
 	regionedFilter := func(tag string) bool {
 		tagContains := ".container"
-		if sensorType == falcon.ImageSensor || sensorType == falcon.KacSensor {
+		if sensorType == falcon.RegionedImageSensor || sensorType == falcon.KacSensor {
 			tagContains = ""
 		}
 

Original file line number	Diff line number	Diff line change
`@@ -258,6 +258,11 @@ func (in Exclusions) DeepCopyInto(out Exclusions) {`
`258`	`258`	`out = make([]string, len(in))`
`259`	`259`	`copy(out, in)`
`260`	`260`	`}`
	`261`	`+ if in.ImageNames != nil {`
	`262`	`+ in, out := &in.ImageNames, &out.ImageNames`
	`263`	`+ out = make([]string, len(in))`
	`264`	`+ copy(out, in)`
	`265`	`+ }`
`261`	`266`	`}`
`262`	`267`
`263`	`268`	`// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Exclusions.`
Original file line number	Diff line number	Diff line change
`@@ -106,6 +106,10 @@ func (r *FalconImageAnalyzerReconciler) newConfigMap(ctx context.Context, name s`
`106`	`106`	`data["AGENT_REGISTRY_EXCLUSIONS"] = strings.Join(falconImageAnalyzer.Spec.ImageAnalyzerConfig.Exclusions.Registries, ",")`
`107`	`107`	`}`
`108`	`108`
	`109`	`+ if len(falconImageAnalyzer.Spec.ImageAnalyzerConfig.Exclusions.ImageNames) > 0 {`
	`110`	`+ data["AGENT_IMAGE_EXCLUSIONS"] = strings.Join(falconImageAnalyzer.Spec.ImageAnalyzerConfig.Exclusions.ImageNames, ",")`
	`111`	`+ }`
	`112`	`+`
`109`	`113`	`data["AGENT_DEBUG"] = strconv.FormatBool(falconImageAnalyzer.Spec.ImageAnalyzerConfig.EnableDebug)`
`110`	`114`
`111`	`115`	`// Registry auto-discovery configuration`
Original file line number	Diff line number	Diff line change
`@@ -49,7 +49,7 @@ func (r *FalconImageAnalyzerReconciler) PushImage(ctx context.Context, log logr.`
`49`	`49`	`image := image.NewImageRefresher(ctx, log, falconApiConfig, pushAuth, falconImageAnalyzer.Spec.Registry.TLS.InsecureSkipVerify)`
`50`	`50`	`version := falconImageAnalyzer.Spec.Version`
`51`	`51`
`52`		`- tag, err := image.Refresh(registryUri, falcon.ImageSensor, version)`
	`52`	`+ tag, err := image.Refresh(registryUri, falcon.RegionedImageSensor, version)`
`53`	`53`	`if err != nil {`
`54`	`54`	`return fmt.Errorf("Cannot push Falcon Image Analyzer Image: %v", err)`
`55`	`55`	`}`
`@@ -139,7 +139,7 @@ func (r *FalconImageAnalyzerReconciler) registryUri(ctx context.Context, falconI`
`139`	`139`	`return "", err`
`140`	`140`	`}`
`141`	`141`
`142`		`- return falcon.FalconContainerSensorImageURI(cloud, falcon.ImageSensor), nil`
	`142`	`+ return falcon.FalconContainerSensorImageURI(cloud, falcon.RegionedImageSensor), nil`
`143`	`143`	`default:`
`144`	`144`	`return "", fmt.Errorf("Unrecognized registry type: %s", falconImageAnalyzer.Spec.Registry.Type)`
`145`	`145`	`}`
`@@ -209,7 +209,7 @@ func (r *FalconImageAnalyzerReconciler) setImageTag(ctx context.Context, falconI`
`209`	`209`	`return "", err`
`210`	`210`	`}`
`211`	`211`
`212`		`- tag, err := registry.LastContainerTag(ctx, falcon.ImageSensor, falconImageAnalyzer.Spec.Version)`
	`212`	`+ tag, err := registry.LastContainerTag(ctx, falcon.RegionedImageSensor, falconImageAnalyzer.Spec.Version)`
`213`	`213`	`if err == nil {`
`214`	`214`	`falconImageAnalyzer.Status.Sensor = common.ImageVersion(tag)`
`215`	`215`	`}`